Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 15:17
General
- Target dbce0a91b7eb769425643570cd58441febfd6bbe3e8a979632d324152abe1d05.exe
- Size 468KB
- Sample260827-sn7rtaaq2x
- SHA256 dbce0a91b7eb769425643570cd58441febfd6bbe3e8a979632d324152abe1d05
Malware Config
Signatures
- Family: KawaiiUnicorn
KawaiiUnicorn is a trojan written in Visual Basic.
- Detects KawaiiUnicorn 64 IoCs
- Executes dropped EXE 45 IoCs
- Program crash 43 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 46 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 45 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbce0a91b7eb769425643570cd58441febfd6bbe3e8a979632d324152abe1d05.exe"C:\Users\Admin\AppData\Local\Temp\dbce0a91b7eb769425643570cd58441febfd6bbe3e8a979632d324152abe1d05.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14367.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-45364.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11103.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-16252.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43252.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53304.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53304.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-63968.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-5779.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-5779.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-65032.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-51283.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-51283.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-53992.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11558.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38824.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-49156.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-61948.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-61948.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-14387.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27032.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27032.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-27795.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-11619.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-26368.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-19456.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-727.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-727.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-3223.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-34163.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exeC:\Users\Admin\AppData\Local\Temp\Unicorn-36659.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 74444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 74043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 75242⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 72441⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 74040⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 74439⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 75238⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 75237⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 74436⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 72435⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 75234⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 75233⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 75232⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 72431⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 74430⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 72829⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 75228⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 74027⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 74426⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 74425⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 75224⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 72423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 75222⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 55221⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 75220⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 72419⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 75218⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 72417⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 75216⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 75215⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 74014⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 72413⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 71612⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 72411⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 74010⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 7449⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 7448⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 7247⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 7246⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 7525⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 7444⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 7443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 7242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1060 -ip 10601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4652 -ip 46521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3800 -ip 38001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3860 -ip 38601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3656 -ip 36561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2996 -ip 29961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4248 -ip 42481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2256 -ip 22561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4664 -ip 46641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4356 -ip 43561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4452 -ip 44521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4856 -ip 48561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 752 -ip 7521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2960 -ip 29601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4928 -ip 49281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2096 -ip 20961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2348 -ip 23481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2776 -ip 27761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2744 -ip 27441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2252 -ip 22521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 764 -ip 7641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4824 -ip 48241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5016 -ip 50161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3976 -ip 39761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4192 -ip 41921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4380 -ip 43801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 552 -ip 5521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4904 -ip 49041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1668 -ip 16681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4564 -ip 45641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2756 -ip 27561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4060 -ip 40601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3456 -ip 34561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4552 -ip 45521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3472 -ip 34721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3068 -ip 30681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1200 -ip 12001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2232 -ip 22321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1836 -ip 18361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5084 -ip 50841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4020 -ip 40201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1064 -ip 10641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Unicorn-11103.exe
Unicorn-11558.exe
Unicorn-13271.exe
Unicorn-13691.exe
Unicorn-14002.exe
Unicorn-14367.exe
Unicorn-14387.exe
Unicorn-16252.exe
Unicorn-16916.exe
Unicorn-23080.exe
Unicorn-23936.exe
Unicorn-25171.exe
Unicorn-30552.exe
Unicorn-36608.exe
Unicorn-38824.exe
Unicorn-42919.exe
Unicorn-43252.exe
Unicorn-43328.exe
Unicorn-45364.exe
Unicorn-49156.exe
Unicorn-51283.exe
Unicorn-53304.exe
Unicorn-53895.exe
Unicorn-53992.exe
Unicorn-5779.exe
Unicorn-57976.exe
Unicorn-58600.exe
Unicorn-61948.exe
Unicorn-63968.exe
Unicorn-64828.exe
Unicorn-65032.exe
Unicorn-7035.exe
memory/552-212-0x0000000000400000-0x0000000000475000-memory.dmp
memory/552-231-0x0000000000400000-0x0000000000475000-memory.dmp
memory/752-112-0x0000000000400000-0x0000000000475000-memory.dmp
memory/752-93-0x0000000000400000-0x0000000000475000-memory.dmp
memory/764-164-0x0000000000400000-0x0000000000475000-memory.dmp
memory/764-183-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1060-0-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1060-16-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1064-312-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1064-327-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1200-302-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1200-282-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1668-228-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1668-247-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1836-294-0x0000000000400000-0x0000000000475000-memory.dmp
memory/1836-309-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-116-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2096-136-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2232-288-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2232-303-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2252-167-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2252-148-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2256-72-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2256-53-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2284-324-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-143-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2348-125-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2744-159-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2756-261-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2756-244-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2776-151-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2776-133-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2960-101-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2960-120-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2996-56-0x0000000000400000-0x0000000000475000-memory.dmp
memory/2996-37-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3068-276-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3068-291-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3108-175-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3108-156-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3168-330-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3456-273-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3456-258-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3472-285-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3472-270-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3580-318-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3656-29-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3656-48-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3800-13-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3800-32-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3860-40-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3860-21-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-188-0x0000000000400000-0x0000000000475000-memory.dmp
memory/3976-207-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4020-306-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4020-321-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4060-252-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4060-267-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4192-215-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4192-196-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4248-45-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4248-64-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-88-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4356-69-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4380-204-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4380-223-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4452-96-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4452-77-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4552-265-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4552-279-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4564-236-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4564-255-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4652-24-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-61-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4664-80-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-191-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4824-172-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4856-104-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4856-85-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4904-239-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4904-220-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-128-0x0000000000400000-0x0000000000475000-memory.dmp
memory/4928-109-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5016-180-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5016-199-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-315-0x0000000000400000-0x0000000000475000-memory.dmp
memory/5084-299-0x0000000000400000-0x0000000000475000-memory.dmp